The heavy metal that poisoned the droid Tyrone Erasmus Introduction - PowerPoint PPT Presentation

The heavy metal that poisoned the droid Tyrone Erasmus

• Introduction • Android Security Model • Static vs. Dynamic analysis • Mercury: New framework on the block • Finding OEM problems • Techniques for malware • How do we fix this? • Conclusion

/usr/bin/whoami • Consultant @ MWR InfoSecurity • My 25% time == Android research • Interested in many areas of exploitation

Introduction • Why android?

Security Model • User-based permissions model • Each app runs as separate UID • Differs from conventional computing • Except when shared UIDs are used • App resource isolation

Security Model

Security Model Application 1 Application 2 shared_prefs shared_prefs files files cache cache databases databases UNIX permissions!

Security Model • App manifest = all configuration + security parameters

Security Model Memory corruption vulnerabilities: • Native elements that can be overflowed • Code execution: • In context of exploited app • With permissions of app • Want more privileges? YOU vs. KERNEL

IPC Apps use Inter-Process Communication • Defined communication over sandbox • Exported IPC endpoints are defined in AndroidManifest.xml

IPC - Activities • Visual element of an application

IPC – Services • Background workers • Provides no user interface • Can perform long-running tasks

IPC – Broadcast Receivers • Get notified of system and application events • According to what has been registered • android.permission.RECEIVE_SMS

IPC – Content Providers • Data storehouse • Often uses SQLite • Methods that are based on SQL queries

IPC Summary • All can be exported • Explicitly by exported=true • Implicitly by <intent-filter> • Content Provider exported by default • Often overlooked by developers

IPC Summary Simple Application Rich Application Activity Activity Service Broadcast receiver Content provider

What they all say • Permissions and developer name Hmmm...

Scary Contradictions • Apps containing root exploits • Browser vulnerabilities • Cross-application exploitation

Cross-application exploitation • What can 1 app do to another? • Completely unprivileged • Malware implications • Android-specific attack surface

Static analysis Examine Write Download Extract Understand Decompile attack custom apps manifests entry points vectors POCs

Static analysis • Iterative • Create/ Time consuming Amend Code Analyse Compile Test Upload

Why Dynamic analysis ? VS. • Time-efficient • Better coverage • Re-usable modules

New tool - Mercury • “The heavy metal that poisoned the droid” • Developed by me 

Mercury...What is it? • Platform for effective vulnerability hunting • Collection of tools from single console • Modular == easy expansion • Automation • Simplified interfacing with external tools

Mercury...Why does it exist!? • Testing framework vs. custom scripts • INTERNET permission – malware can do it too! • Share POCs – community additions

Mercury...How does it work? Client/Server model • Low privileges on server app • Intuitive client on pc Client Server ( On PC) ( On Device)

Mercury...Show me your skills • Find package info • Attack surface • IPC info • Interacting with IPC endpoints • Shell

Interesting fact #1 ANY app can see verbose system info • Installed apps • Platform/device specifics • Phone identity

Impact Profile your device • Get exploits for vulnerable apps • Better targeting for root exploits • Use this info track you • Only Required permission: INTERNET

Interesting fact #2 • Any app with no permissions can read your SD card • It is the law of the UNIXverse

Impact • A malicious app can upload the contents of your SD card to the internet • Photos • Videos • Documents • Anything else interesting? • Only Required permission: INTERNET

Debuggable apps • More than 5% of Market apps • Allow malicious apps to escalate privileges • debuggable=true Open @jdwp-control socket 

Mercury...So I can extend it? • Remove custom-apps == Quick tests • Create new tools • Share exploit POCs on GitHub • Some cool modules included already: • Device information • Netcat shell • Information pilfering OEM apps

Mercury...Dropbox example • Custom exploit app • No structure for debugging

OEM apps • Pre-installed apps often == vulnerabilities • Many security researchers target these apps

OEM apps Lets find some leaky content providers! • Promise of: • Information pilfering glory • Rampant SQLi • No custom app development

Research findings Leaks instant messages from: • Google Talk • Windows Live Messenger • Yahoo! Messenger

Research findings Leaks: • Facebook • MySpace • Twitter • LinkedIn

OEM apps HTCloggers.apk allows any app with INTERNET • ACCESS_COARSE_LOCATION • ACCESS_FINE_LOCATION • ACCESS_LOCATION_EXTRA_COMMANDS • ACCESS_WIFI_STATE • BATTERY_STATS • DUMP • GET_ACCOUNTS • GET_PACKAGE_SIZE • GET_TASKS • READ_LOGS • READ_SYNC_SETTINGS • READ_SYNC_STATS

Research findings Leaks: • Email address and password • Email content • IM & IM contacts

Research findings Leaks: • SMS using SQLi • Credits to Mike Auty – MWR Labs • Feels so 2000’s

OEM apps Steps to win: • Webkit vulnerability • Browser has INSTALL_PACKAGES • Exported recording service • Bugging device 

Research findings Leaks: • SMS • Emails • IMs • Social Networking messages

Research findings Leaks: • Portable Wi-Fi hotspot • SSID • WPA2 password

Research findings • Have found more than 10 similar type vulnerabilities • Across many OEM apps

Research findings - Impact An app with 0 granted permissions can get: • Email address and password • Email contents • SMS • IM & IM contacts • Social networking messages • Call logs • Notes • Current city • Portable Wi-Fi hotspot credentials

Why is this happening? Manufacturers bypass OS features • Lack of knowledge? • Tight deadlines?

Malware deluxe Building a user profile • Installed package info • Upload entire SD card • Pilfer from leaky content providers • Get device/platform info

Malware deluxe Useful binaries for device/platform info • toolbox • dumpsys • busybox Promise of: • Useful info

Malware deluxe Dirty tricks • Pipe a shell using nc • Crash the logreaders Promise of: • Shells - everybody loves ‘ em  • Someone actually doing this 

Malware deluxe Fresh exploits • Installed apps + versions • Download latest available exploits • Exploit vulnerable apps for fun/profit • Same goes for root exploits

Android the blabbermouth Permissions required: android.permission.INTERNET

Which would you install?

How do developers fix this? • Can’t help Android vulnerabilities • Can make secure apps • Stop information being stolen from your app • Check exposure with Mercury

Mercury – Future plans • Testing ground for exploits of all kind • Full exploitation suite?

return 0; • Feedback forms • Questions?